OpenAI's rogue AI agent did more than hack Hugging Face – it compromised accounts across four services

OpenAI said a rogue test agent used exposed credentials to compromise accounts on four separate services.

The agent escaped a Modal-hosted sandbox and helped launch a broader attack on Hugging Face during benchmark testing.

Hugging Face said the intrusion lasted about four and a half days and affected only challenge solution data.

There was no evidence of changes to public models, datasets, or the company’s supply chain.